Splunk Search

Panels take time to change

NS
Explorer

Hi All,

I am trying to display panel-One when selected One from the dropdown option, and panel-Two when selected Two from the dropdown option, and so on. It was working perfectly fine until last week, but now the issue is:

When i select dropdown option One, no panel is displayed, when i select Two, Panel-One is displayed, and later when i select Three, the last selected dropdown option panel is selected, ie. Two.

Can someone urgently help please? My dashboard is completely messed up now, and I cant figure out where the actual problem is.

Many thanks in advance 🙂

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your problem is with line 65!

Only joking! It would help us help you if you provided your Simple XML!

0 Karma

NS
Explorer

Here is the XML:

 

<input type="dropdown" token="theme">
<label>Theme</label>
<choice value="one">Panel One</choice>
<choice value="two">Panel Two</choice>
<choice value="three">Panel Three</choice>
<choice value="four">Panel Four</choice>
<choice value="five">Panel Five</choice>
<change>
<condition match="$theme$==&quot;one&quot;">
<set token="one">1</set>
<unset token="two"></unset>
<unset token="three"></unset>
<unset token="four"></unset>
<unset token="five"></unset>
</condition>
<condition match="$theme$==&quot;two&quot;">
<set token="two">1</set>
<unset token="one"></unset>
<unset token="three"></unset>
<unset token="four"></unset>
<unset token="five"></unset>
</condition>

.

.

.

and so on, for all five panels
</change>

 

Later under each panel, am assigning the token:

<row>
<panel depends="$one$">

.........

</panel>

</row>

 

Kindly help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

<input type="dropdown" token="theme">
<label>Theme</label>
<choice value="one">Panel One</choice>
<choice value="two">Panel Two</choice>
<choice value="three">Panel Three</choice>
<choice value="four">Panel Four</choice>
<choice value="five">Panel Five</choice>
<change>
<condition match="$theme$==&quot;one&quot;">
<set token="one">1</set>
</condition>
<condition>
<unset token="one"></unset>
</condition>
</change>
<change>
<condition match="$theme$==&quot;two&quot;">
<set token="two">2</set>
</condition>
<condition>
<unset token="two"></unset>
</condition>
</change>
<change>
<condition match="$theme$==&quot;three&quot;">
<set token="three">3</set>
</condition>
<condition>
<unset token="three"></unset>
</condition>
</change>
<change>
<condition match="$theme$==&quot;four&quot;">
<set token="four">4</set>
</condition>
<condition>
<unset token="four"></unset>
</condition>
</change>
<change>
<condition match="$theme$==&quot;five&quot;">
<set token="five">5</set>
</condition>
<condition>
<unset token="five"></unset>
</condition>
</change>
0 Karma

NS
Explorer

I tried this, it worked while i tested it the first time, and then the same issue continued after i refreshed the dashboard. Please help !

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding an unset of theme to each change block

<unset token="theme"></unset>
0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...